ANAC ICAR Theoretical Exam (AVSEC Cargo Instructor) cheat sheet

ICAO Annex 17 sets the Standards and Recommended Practices (SARPs) for safeguarding international civil aviation against acts of unlawful interference; cargo and mail security obligations sit mainly in the cargo/mail provisions, which require screening, secure supply chain controls and protection from unauthorized interference.

Annex 9 (Facilitation) is the interface for cargo documentation and clearance; security measures must be applied so that facilitation processes (declarations, manifests, consignment data) do not create gaps through which unscreened or unaccompanied cargo enters the system.

ICAO Doc 8973 (Security Manual) provides implementation guidance: it explains how states translate Annex 17 SARPs into national programmes, including regulated agent and known consignor concepts, screening methods and quality control.

Hierarchy of authority: ICAO SARPs bind contracting states through the Chicago Convention; states then issue national legislation and civil aviation authority regulations (in Peru, ANAC resolutions and directives) that apply to operators, regulated agents and known consignors.

A regulated agent is an entity approved by the appropriate authority to apply security controls to cargo; a known consignor is an entity approved to originate cargo under security controls. Both statuses depend on a documented security programme accepted by the authority.

National programmes typically require a security programme for each regulated agent, a site security plan for each facility, designation of a security manager, and acceptance of security controls by the competent authority before any cargo is tendered as secured.

Annex 17 requires each state to establish a quality control function to verify that security measures are implemented; audits, inspections and tests of the cargo supply chain are legal obligations, not optional good practice.

Where a state has not fully implemented a SARP, the difference must be notified to ICAO; for exam purposes, a national rule that is stricter than Annex 17 is permissible because SARPs are minimum standards.

An act of unlawful interference is any act (or attempted act) that endangers the safety of civil aviation, including sabotage, hijacking, attacks on facilities, and the introduction of a weapon or dangerous device into the aviation system.

Explosive devices in cargo may be military or commercial explosives, improvised explosives (IEDs) made from fertilizers, peroxides or chlorates, or devices concealed in consignments; the threat is delivery to an aircraft or facility rather than direct attack.

Improvised explosive devices typically combine a power source, a switch or trigger, an initiator and a main charge; an X-ray image may show wires, batteries, dense irregular masses or unusual organic/inorganic mixtures, but many IEDs are designed to appear benign.

Incendiary devices (thermal, chemical or pyrotechnic) are a distinct threat from explosives: they start fires rather than produce blast, and may be triggered by time delay, chemical reaction or altitude/pressure change.

Insider threat is the most significant risk in cargo: a person with legitimate access can bypass screening, substitute consignments, tamper with seals, disclose screening schedules or place devices after screening.

Sabotage methods relevant to cargo include concealment in pallets or containers, substitution of screened cargo, tampering with tamper-evident seals, and exploitation of unaccompanied or transit cargo that is not re-screened.

Threat assessment uses intelligence, vulnerability analysis and consequence analysis; the resulting risk picture determines the level of screening and the proportion of cargo subject to random or targeted inspection.

Indicators that warrant escalation include consignments with no known consignor, mismatched documentation, unusual routing, cash payment, reluctance to provide consignor details, and shipments from regions with active threat reporting.

Regulated agent: an entity approved by the appropriate authority to apply security controls to cargo and mail; it may accept cargo from known consignors or from other regulated agents and tender it as secured after screening or secure handling.

Known consignor: an entity approved to originate cargo under security controls; cargo from a known consignor may be treated as screened only if the approval, the site security plan and the chain of custody remain intact.

Approval process steps: application, documented security programme, site security plan, on-site validation by the authority or its delegate, corrective actions, approval decision, and periodic revalidation.

Validation checks physical security (perimeter, access control, locks, alarms), personnel security (vetting, background checks, training records), process security (screening, storage, sealing) and documentation control.

The security programme is the entity's written description of how it meets regulatory requirements; the site security plan is the facility-specific implementation, including layout, access points, screening locations and storage areas.

Approval is conditional and can be suspended or revoked for failure to maintain standards; changes to facilities, ownership, processes or key personnel must be notified to the authority.

Known consignor status is not transferable: cargo from a known consignor that has been stored by an unapproved party, or whose seal is broken, loses its secured status and must be re-screened.

Records supporting approval (training, screening, seals, access logs, audits) must be retained for the period set by the national authority and made available on request.

Acceptance begins with verification of the consignment against documents: consignor identity, air waybill data, piece count, weight, packaging integrity and the security status declared by the tendering party.

X-ray screening is effective for identifying dense objects, wires, batteries and anomalous shapes; it is limited by object orientation, clutter, packaging density and operator image interpretation skill.

Explosive trace detection (ETD) samples surfaces and detects trace residues of explosives; it is a trace method and cannot prove the absence of a device, so it is combined with other measures and with random sampling.

Explosive detection systems (EDS) automatically analyse images and alarm on threat-like characteristics; they require configuration control, calibration, regular testing with test pieces and performance monitoring.

Physical search (hand search) is the reference method for resolving alarms and for cargo that cannot be screened by other means; it requires trained staff, safe procedures and a defined search standard.

Screening exemptions exist only under conditions defined by the authority (for example, cargo from an approved known consignor with intact chain of custody); any exemption must be documented and justified.

When screening equipment alarms, the cargo cannot be released until the alarm is resolved by a higher-level method (repeat scan from another angle, ETD, physical search) and the resolution is recorded.

Screening must be performed by trained, certified personnel; the method chosen must be appropriate to the consignment type, and the results must be recorded so that the security status can be traced.

Chain of custody is the documented, unbroken record of who controlled the cargo from screening to loading; any break requires re-screening or re-verification before the cargo can be treated as secured.

Secure storage must be a controlled area with restricted access, locks, alarms where required, and protection from unauthorised entry; screened cargo is stored separately from unscreened cargo.

Access control uses identification, authorisation, escorting of visitors and logging of entry; personnel with access to secured cargo must be vetted and trained.

Tamper-evident seals must be uniquely numbered, applied at the point of screening, and the seal number recorded on the documentation; a broken, missing or mismatched seal invalidates the secured status.

Seal integrity is checked at each handover: at storage, at transfer to the transporter, at the aircraft and at any intermediate point; each check is recorded.

Transport of secured cargo requires an approved transporter, a documented route and schedule, and protection against interference; unescorted cargo must remain sealed and under control.

Documentation accompanying secured cargo includes the security status declaration, seal numbers, screening method and the identity of the person who applied controls.

Handover to the aircraft operator is a formal step: the operator verifies seals, documentation and identity, and records acceptance; discrepancies are treated as security occurrences.

Needs analysis identifies who needs training, what tasks they perform, what the regulation requires and what performance gaps exist; it precedes the definition of objectives.

Learning objectives are written in observable, measurable terms (for example, 'identify', 'apply', 'resolve an alarm'), and each objective is linked to a task and an assessment method.

Competency-based training defines the standard of performance, the conditions and the criteria; competency is demonstrated, not merely attended.

Instructional methods are selected to match the objective: classroom for knowledge, demonstration for procedures, practical exercises and simulation for skills, on-the-job coaching for transfer.

Assessment design uses valid, reliable items mapped to objectives; practical assessments use checklists with defined critical pass/fail points.

Evaluation of effectiveness uses Kirkpatrick-style levels: reaction, learning, behaviour on the job and results; records of assessment and competence must be retained.

Training records include syllabus, objectives, attendance, assessment results, instructor qualification and refresher dates; records support audit and revalidation.

Refresher training intervals and content are set by the authority; recurrent training must address changes in threat, equipment and procedures.

Instructor competence combines subject-matter expertise, instructional skill, assessment skill and professional conduct; the authority may require documented instructor qualification and currency.

Adult learning principles: adults are goal-oriented, bring experience, need relevance and practice, and learn best when they can apply knowledge to their own tasks.

Communication skills include clear structure, appropriate pace, checking understanding, active listening and adapting language to the audience.

Classroom management uses clear ground rules, time control, participation techniques and handling of difficult behaviour without confrontation.

Practical exercise management requires briefing, demonstration, supervised practice, safety control and debriefing; the instructor observes and records performance against a checklist.

Coaching and feedback should be specific, timely, behaviour-focused and constructive; feedback on errors is followed by corrective practice.

Professional conduct includes integrity in assessment, confidentiality of security information, avoidance of conflicts of interest and modelling of security discipline.

Record keeping by the instructor covers attendance, assessment results, remedial actions and any incident during training; records must be accurate and auditable.

Equipment operation requires trained operators, correct settings, and adherence to the manufacturer's procedures; operators must know the equipment's capabilities and limits.

Calibration and testing are performed at defined intervals and after repair or relocation; test pieces or test images verify that the equipment detects known threats.

Maintenance oversight includes a maintenance schedule, records of service, fault reporting and removal of equipment from service when performance is not verified.

Human factors degrade screening: vigilance decrement over time, fatigue, complacency, expectation bias, confirmation bias and tunnel vision all reduce detection performance.

Mitigations for human factors include rotation of operators, adequate breaks, threat image projection, random re-screening, supervision and performance feedback.

Image interpretation depends on orientation, overlap and density; operators must use multiple views and alternative methods when an image is ambiguous.

Alarm resolution must follow procedure; skipping or shortcutting resolution steps is a human-factors failure that audits should detect.

Performance monitoring uses detection rates, false alarm rates and audit results; trends trigger retraining or equipment review.

Contingency plans define response to bomb threats, discovered devices, breaches of secure areas, equipment failure and loss of chain of custody; plans are tested by exercises.

Incident response sequence: protect life, isolate and secure the area, do not touch suspected devices, notify the security manager and authorities, preserve evidence and record actions.

Security occurrences that must be reported include breaches of security, tampering, unauthorised access, screening failures and discovery of prohibited items; reporting timelines are set by the authority.

Reporting must be factual, timely and complete; the report supports investigation, corrective action and notification to the state as required by Annex 17.

Quality control verifies compliance through audits, inspections, tests and covert trials; it is independent of the operational unit being checked.

Internal audit uses defined scope, criteria, evidence and findings; findings are graded and tracked to closure.

Corrective action includes root-cause analysis, action plan, responsible person, deadline and verification of effectiveness; recurrence indicates a systemic failure.

Quality records and audit results feed management review, training needs analysis and revision of the security programme.

ICAO Annex 17 SARPs are implemented through national regulations; where a state aligns with EU-style rules, the national authority adopts comparable regulated agent and known consignor regimes.

ANAC resolutions and directives are the binding national instruments for Peruvian operators, regulated agents and known consignors; they specify approval, training, screening and reporting requirements.

Regulatory change management: entities must monitor amendments, update their security programme and retrain staff when requirements change.

The authority's oversight functions include approval, validation, inspection, audit, enforcement and, where provided, sanctions for non-compliance.

Security programmes submitted for approval must demonstrate compliance with each applicable requirement and identify the responsible persons and records.

Cross-border recognition of secure status depends on the exporting state's regime and on documentary evidence; cargo from an unrecognised regime must be screened on arrival.

Documentation must be retained and produced on request; failure to produce records is itself a compliance finding.

Instructor role in compliance: training content must reflect the current national regulation and the entity's approved security programme, not generic international guidance alone.

Mail is treated as cargo for security purposes but has specific handling rules; postal operators and mail handlers apply screening and chain-of-custody controls.

Annex 9 facilitation requirements interact with security: advance electronic data and consignment information support risk assessment before arrival.

Mail that cannot be screened may be subject to alternative measures defined by the authority, including physical inspection or refusal.

Consignments of unknown origin, unaccompanied baggage and express parcels require verification of security status before acceptance.

Documentation for mail and express cargo must identify the tendering party and the security controls applied.

Screening of mail must respect legal protections on correspondence while meeting security requirements; national law defines the balance.

Instructor certification requires evidence of subject knowledge, instructional competence and assessment competence; currency must be maintained.

Assessment instruments must be validated against objectives; practical checklists define critical errors that cause failure regardless of total score.

Remedial training follows failed assessment; the record shows the gap, the remediation and the re-assessment result.

Competence records are retained for the period required by the authority and are available for audit.

Assessment integrity requires secure test materials, consistent conditions and independent marking where required.

Evaluation of training effectiveness uses post-course performance data, audit findings and incident trends to revise the programme.

Exemptions are permitted only where the national authority defines them and the conditions are fully met; the burden of proof is on the entity claiming the exemption.

Typical conditions include approved known consignor status, uninterrupted chain of custody, intact tamper-evident seals and verified documentation.

Any break in custody, seal or documentation removes the exemption and requires screening before loading.

Exempted cargo remains subject to random inspection and quality control checks.

Records must show the basis for the exemption and the identity of the person who verified it.

Insider risk controls include vetting, role-based access, segregation of duties, supervision and random checks of staff and vehicles.

Screening staff should not screen their own consignments; rotation and independent verification reduce collusion risk.

Access logs, CCTV and seal records support detection and investigation of insider activity.

Reporting channels must allow staff to report suspicious behaviour without fear of reprisal.

Behavioural indicators and unexplained affluence or unusual interest in security procedures warrant referral under the entity's policy.

Quality control activities include inspections, tests, covert trials, record reviews and equipment performance checks.

Internal audits are planned, scoped and performed by competent persons with defined criteria and evidence.

Findings are graded by severity; critical findings require immediate containment and notification.

Corrective action closes the loop: root cause, action, owner, deadline and verification.

Audit results are reviewed by management and used to update training and the security programme.

Records of audits and corrective actions are retained and available to the authority.

Vigilance decreases with time on task; rotation and breaks are required to maintain detection performance.

Fatigue, stress and workload increase error rates; scheduling and staffing must account for this.

Expectation and confirmation bias cause operators to miss unexpected threats; threat image projection and random checks counter this.

Supervision and feedback improve performance; performance data should be monitored and used for retraining.

Ambiguous images require alternative methods; operators must not guess or shortcut resolution.

Plans cover bomb threats, discovered devices, breaches, equipment failure and loss of custody.

Response prioritises life safety, isolation, notification and evidence preservation.

Exercises test plans and identify gaps; results feed corrective action.

Reports to the authority are timely, factual and complete.

Lessons learned are incorporated into training and plan revision.

Documentation identifies consignor, consignee, security status, screening method and seal numbers.

Transport is by approved means with documented route and protection against interference.

Handover checks verify seals, documents and identity at each stage.

Discrepancies are treated as security occurrences and reported.

Records are retained for the required period.

Needs analysis identifies tasks, audiences, regulatory requirements and performance gaps.

Objectives are observable, measurable and linked to assessment.

Content is sequenced from knowledge to application to competence.

Assessment methods are selected to match objectives.

Evaluation data feeds revision of the programme.

Clear structure, appropriate pace and checking understanding improve learning.

Active participation and relevant examples increase retention.

Ground rules and time control support classroom management.

Difficult behaviour is handled calmly and privately where possible.

Practical exercises are briefed, supervised and debriefed.

Calibration and testing occur at defined intervals and after repair.

Test pieces verify detection performance and are recorded.

Faults are reported and equipment removed from service until verified.

Maintenance records are retained and available for audit.

Performance trends trigger review and retraining.

Validation checks physical, personnel, process and documentation security.

Site security plans describe facility-specific controls.

Approval is conditional and subject to revalidation.

Changes must be notified to the authority.

Records support validation and audit.

X-ray, ETD, EDS and physical search have different capabilities and limits.

Alarms are resolved by a higher-level method and recorded.

Method selection depends on consignment type and threat.

Screening is performed by trained, certified personnel.

Results are recorded to preserve traceability.

Custody is documented from screening to loading.

Seals are uniquely numbered and recorded.

Broken or mismatched seals invalidate secured status.

Integrity is checked at each handover.

Breaks require re-screening.

Screened and unscreened cargo are stored separately.

Access is restricted, authorised and logged.

Visitors are escorted.

Personnel are vetted and trained.

Storage areas are protected against unauthorised entry.

IEDs combine power source, switch, initiator and charge.

Incendiary devices start fires rather than blast.

Concealment exploits packaging, pallets and containers.

X-ray may show wires, batteries and dense masses.

Ambiguous images require alternative methods.

Reportable events include breaches, tampering, unauthorised access and screening failures.

Reports are timely, factual and complete.

Reports support investigation and corrective action.

Notification to the authority follows national timelines.

Records are retained.

Assessment items map to objectives and are valid and reliable.

Practical checklists define critical pass/fail points.

Evaluation uses reaction, learning, behaviour and results.

Remediation follows failure and is recorded.

Effectiveness data revise the programme.

Integrity in assessment and confidentiality of security information are required.

Conflicts of interest are avoided.

Records cover attendance, results, remediation and incidents.

Records are accurate and auditable.

Instructors model security discipline.

Mail is treated as cargo with specific handling rules.

Advance electronic data supports risk assessment.

Unscreened mail may be subject to alternative measures.

Documentation identifies the tendering party and controls.

Legal protections on correspondence are respected.

Recognition depends on the exporting state's regime and documentary evidence.

Unrecognised cargo is screened on arrival.

Documentation must show the controls applied.

Records support recognition decisions.

Changes in regime affect recognition.

Audit and quality data feed management review.

Review identifies systemic issues and resourcing needs.

Actions are assigned, tracked and verified.

Training and security programmes are updated.

Improvement is documented and retained.